For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred, and any necessary patches or releases are available. To learn more about Apple Product Security, visit the Apple Product Security website.

iTunes 6.0.5

iTunes

CVE-ID: CVE-2006-1467

Available for: Mac OS X v10.2.8 or later, Windows XP / 2000

Impact: An integer overflow in iTunes could cause a denial of service or lead to the execution of arbitrary code

Description: The AAC file parsing code in iTunes versions prior to 6.0.5 contains an integer overflow vulnerability. Parsing a maliciously-crafted AAC file could cause iTunes to terminate or potentially execute arbitrary code. iTunes 6.0.5 addresses this issue by improving the validation checks used when loading AAC files. iTunes 6.0.5 is freely available from http://www.apple.com/itunes/download/. Credit to ATmaCA working with TippingPoint and the Zero Day Initiative for reporting this issue.